security: 执行平台安全加固

【已完成】
- 关闭FRP SSH隧道 (消除公网暴露风险)
- 移除MySQL/Redis端口映射 (仅内网访问)
- 启用UFW防火墙 (deny all + allow 80/443)
- 关闭临时Python HTTP服务 (端口8888)
- 配置定期备份脚本 (每日2点执行)
- 更新监控告警规则 (新增登录异常检测)

【待手动完成 - 需sudo】
- 启用FRP TLS加密 (修改/opt/frp/frpc.ini)
- 延长日志留存180天 (修改/opt/frp/frpc.ini)

infra/deploy/compose.local.yaml

@@ -10,8 +10,6 @@ services:
       MYSQL_ROOT_PASSWORD: root-lehuo-2026
       MYSQL_USER: lehuo
       TZ: Asia/Shanghai
-    ports:
-      - '3306:3306'
     volumes:
       - mysql-data:/var/lib/mysql
     healthcheck:
@@ -27,8 +25,6 @@ services:
     image: redis:7.4-alpine
     restart: unless-stopped
     command: ['redis-server', '--appendonly', 'yes']
-    ports:
-      - '6379:6379'
     volumes:
       - redis-data:/data
     healthcheck:

infra/monitoring/alert-rules.yml

@@ -21,3 +21,13 @@ groups:
         for: 10m
         labels: { severity: critical }
         annotations: { summary: '超过 26 小时无成功数据库备份' }
+      - alert: FailedLoginSpike
+        expr: rate(lehuo_auth_failed_login_total[5m]) > 10
+        for: 5m
+        labels: { severity: warning }
+        annotations: { summary: '检测到异常登录失败 spike (>10次/分钟)' }
+      - alert: BruteForceAttempt
+        expr: rate(lehuo_auth_failed_login_total{actor_role="SUPER_ADMIN"}[10m]) > 5
+        for: 5m
+        labels: { severity: critical }
+        annotations: { summary: '管理员账号疑似暴力破解 (>5次失败/分钟)' }

scripts/db-backup.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+set -e
+BACKUP_DIR="/home/climber/backups/lehuo"
+DATE=$(date +%Y%m%d_%H%M%S)
+mkdir -p $BACKUP_DIR
+
+# 使用lehuo用户备份（不需要密码）
+docker exec lehuo-local-mysql-1 mysqldump -ulehuo -pchange-me-local-only lehuo > "$BACKUP_DIR/lehuo_$DATE.sql" 2>/dev/null
+gzip "$BACKUP_DIR/lehuo_$DATE.sql"
+echo "[$DATE] 数据库备份完成: lehuo_$DATE.sql.gz ($(du -sh $BACKUP_DIR/lehuo_$DATE.sql.gz | cut -f1))"
+
+# 清理30天前的备份
+find $BACKUP_DIR -name "*.sql.gz" -mtime +30 -delete
+
+# 备份SSL密钥
+if [ -d /home/climber/lehuo/ssl ]; then
+    tar czf "$BACKUP_DIR/ssl_keys_$DATE.tar.gz" -C /home/climber/lehuo ssl/ 2>/dev/null || true
+    find $BACKUP_DIR -name "ssl_keys_*.tar.gz" -mtime +30 -delete
+    echo "[$DATE] SSL密钥备份完成"
+fi
+
+echo "[$DATE] 备份任务完成"